An issue exists in the webhook delivery component that fails to properly validate target addresses, enabling Server-Side Request Forgery (SSRF). SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. An authenticated user with ProjectAdmin permissions can configure a webhook policy targeting private or link-local IP ranges. When a project event occurs, the jobservice sends unauthenticated outbound HTTP POST requests to the specified target. If the target returns an error status, the response body is recorded in the webhook execution log, which is accessible to project members, potentially exposing cloud metadata or other network-restricted resources.